<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<blockquote cite="midmailman.1.1156953601.18972.sc-l@securecoding.org"
type="cite">
<pre wrap="">
Message: 1
Date: Tue, 29 Aug 2006 15:48:17 -0400
From: <a class="moz-txt-link-abbreviated" href="mailto:pmeunier@purdue.edu">pmeunier@purdue.edu</a>
Subject: Re: [SC-L] How can we stop the spreading insecure coding
examples at training classes, etc.?
To: "Wall, Kevin" <a class="moz-txt-link-rfc2396E" href="mailto:Kevin.Wall@qwest.com"><Kevin.Wall@qwest.com></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:SC-L@securecoding.org">SC-L@securecoding.org</a>
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:1156880897.44f49a01620aa@webmail.purdue.edu"><1156880897.44f49a01620aa@webmail.purdue.edu></a>
Content-Type: text/plain; charset=ISO-8859-1
Quoting "Wall, Kevin" <a class="moz-txt-link-rfc2396E" href="mailto:Kevin.Wall@qwest.com"><Kevin.Wall@qwest.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">I think that this practice of leaving out the "security
details" to just make the demo code short and sweet has got
to stop. Or minimally, we have to make the code that people
copy-and-paste from have all the proper security checks even
if we don't cover them in training. If we're lucky, maybe
they won't delete them when the re-use the code.
</pre>
</blockquote>
<pre wrap=""><!---->
I agree, and would like to extend it: security should be discussed *at the same
time* that a topic is. Teaching security in a separate class, like I have been
doing, reaches only a fraction of the audience, and reinforces an attitude of
security as an afterthought, or security as an option. Comments in the code
should explain (or refer to explanations of) why changing or deleting those
lines is a bad idea.
However, I'm afraid that it would irritate students, and make security the new
"grammar and spelling" for which points are deducted from "perfectly valid
write-ups" (i.e., "it's my ideas that count, not how well I spell"). </pre>
</blockquote>
The same used to be said about unstructured programming examples
(computed gotos, spaghetti code, multiple entry and exit points from
functions, etc). We got past it.<br>
<br>
We need a similar revolution in thought with regard to security, and
some one to take the lead on providing clear, crisp examples of coding
style that is more secure by its nature. I don't have one handy - but
that's my wish.<br>
<br>
Ed<br>
</body>
</html>